Notes on this

• Satoshi Nakamoto’s identity is unknown.
• First paper in 2007.
• First client in 2008.

Physical money transfers don’t require an external party. Digital money transfers require a mediator. This reality has implications.

• Minimum transactions cost rise.
• Merchants need information about customers to build trust as transactions are reversible.

There is a need for a digital payments system where trust is ensured by incentives, probability and computation.

A mediator decides what transactions go through, and how safe the system is.

Firstly, Owning bitcoins isn’t like having dollars in a bank account. Balances are computed based on transactions that are chained to each other. How much you own is defined by the transactions that send you coins that you didn’t use.

A cryptographic hash functions is a black box that takes a a string as input and returns a number as output.

Cryptographic hash functions have many useful properties:

• they are functions in the mathematical sense.
• they are computationally cheap.
• A small change in the input leads to a big change in the output.
• It’s unfeasable that two inputs generate the same output.
• No computationally cheap inverse.

injective, computationally cheap, functional, no inverse.

Asymmetric Cryptography.

Typical use case:

• Bob wants to send a message to Alice that only she can read.
• We want to verify who the sender of a message is.

Bitcoin currently uses ECDSA standard for asymmetric cryptography.

A pair of private and public entities are generated for every entity. An entity being a computer, a bitcoin address or a person.

Bob can use his private key to sign documents and anyone can use bob’s public key to verify that that owner of the private key actually signed it.

A bitcoin address is generated by several hash functions on a ECDSA public key.

Anyone is able to generate their own unique ECDSA private and public keys and are thus able to generate their own bitcoin address.

A transaction is a transfer of value from one or more inputs to one or more outputs.

txid is a transaction hash based on the contents of the transaction itself.

vin is the inputs of the transaction.

vout is the outputs of the transaction.

Each input in vin has the following:

• A txid, i.e. the hash of the previous transaction that send bitcoins to us.
• A vout which specifies which output we pick from that transaction
• An addr which specifies to whom the bitcoins are being sent to.
• A value which specifies how many bitcoins are being sent.

Each output in vout has the following:

• A value which is the ammount we’re sending.
• n: the number of outputs.

Finally there is valueIn, valueOut, and fees. which is a summary of bitcoin input and output values and what reward goes to the machine processing the transaction.

A timestamp uses a sequence of characters to determine when an event occured. In UNIX its common to use seconds since january 1st 1970.

If we introduce that value in the hash generation of transcations/blocks we make sure the data existed at that moment. There is no way to generate the hash with the same data for a different timestamp.

As each hash depends on the previous one we enforce this relation by each new transaction.

Proof of Work

The hash-256 function produces a fixed-length (256 bit) string in hexadecimal.

The output of a hash-256 function varies drastically for small changes on the input.

This assymetry of I/O has been exploited in Hashcash to ensure that a certain operation has a cost associated with it.

Consider for instance the case of reducing email spam. I give you a challenge to be resolved before you are able to send me email. Sending the email will therefore cost you some computer power and hence some electricity and hence some money. the cost should be small enough as to allow legitimate email through but high enough to avoid a spammer sending many emails.

What could such challenge be?

Find a number which when appended to the content will produce a binary output with a certain amount of 0’s at the beginning.

Why? because it gives us firm probability. And anyone can check our solution by calculating the hash functions just once.

We need to find a way to give incentives to distributed machines to find consensus on what is the current state and order of the transcations within the blocks that form the blockchain.

The nonce is the number we have to increment until we satisfy the 0’s challenge.

Bitcoin applies the hash function to the header of the block.

decision making is achieve by the longest chain.

If the mayority of the CPU is held by honest nodes, their chain will outpace attackers: The probability of changing a past block and catching up diminishes exponentially by every block that is added as the attacker would have to redo the work of that block. All the blocks after it and surpass the current nodes work.

The difficulty of the PoW challenge is automatically updated so it keeps it hard enough taking into account the increasing hardware speeds and changing financial interests.

There is a desired average minning speed of one block every 10 minutes.

There is a block called the genesis block and it is hardcoded into the bitcoin core.

• Transactions are broadcasted to all nodes.
• Nodes collect transactions into a single block.
• Once enough transactions are found they are validated.
• Once valid, PoW is performed on them to form the block.
• Performing PoW of a new block implicitly acknowledges the validity of the existing chain.

Every mined block has a first transaction called a coinbase transaction. It’s the one that gives a reward to the miner for doing PoW. that’s how bitcoins are initially put into circulation and the amount of rewards gets halved roughly every 4 years.

The other incentive is the transaction fee.

Even if a malicious entity gets more CPU thanb everyone else they will find it more profitable to act honestly, than to undermine the system.

There is a game theoretic argument that they system will not be attacked aslong as it’s more profitable not to do so.

A merkle tree allows us to relate all transactions to one another.

leaf nodes are a hash function applied to some data.

Upper nodes are a hash function applied to the concatenation of their respective children hashes.

Checking if a transaction is part of block has logarithmic cost in a merkleTree.

An eliptic curve is the set of all points that satisfy the equation

\[ y^2 = x^3 + ax + b \]

If you take an arbitrary point \(P\) on this curve and add it to another arbitrary point on the curve \(Q\) you will get another point located on this very eliptic curve.

You can take a point on the curve an multiply it by \(x\) and you will get some point on the curve.

Cryptography uses the fact that it is computationally infeasable to calculate \(x\) given \(P\) and \(Q\).

This is described as the problem of solving the discrete logarithm.

For eliptic curve cryptography one chooses an appropriate \(P\) on the curve lets the private key be seem some sufficiently large number \(x\) and makes the public key \(Px\).

\[ \text{signature} = \text{Sign}(M, priv) \]

The public key is a combination of the \(x\) and \(y\) coordinate on the curve P256.

Nonce is the number that miners race to find in order to try to sign the block.